how do I trace a logon failure

Hi,

A client has had a list of failed OWA access logons. The event logs show error 529 logon type 8. The IP address is of the router which indicates an external attempt. The suspision is that its a recently dismissed member of staff.... the attempt was with all the managers accounts. How do I trace the original IP.....? the ones in the events just show the routers IP